Computers & Security, 18 (1999) 28-34
Computer Hacking and Cyber Terrorism: The Real Threats in the New Millennium? S.M.Furnelb and M.J.Warren#
_i h’e~work Research Group, School (zf Electronic, Commurzica~ion and Electrical Engineering, Universify of Plymouth, Plymouth, UK; E-mail: [email protected]. # School of Computing and Matheunarics, Deakin University, Geelong, Victoria, Australia; E-mail:, [email protected]
As the new millennium approaches, we are living in a society that
is increasingly dependent upon information technology. However,
whilst technology can deliver a number of benefits, it also intro-
duces new vulnerabilities that can be exploited by persons with
the necessary technical skills. Hackers represent a well-known
threat in this respect and are responsible for a significant degree of
disruption and damage to information systems. However, they are
not the only criminal element that has to be taken into consider-
ation. Evidence suggests that technology is increasingly seen as
potential tool for terrorist orgamzatlons. This is leading to the
emergence of a new threat in the form of ‘cyber terrorists’, who
attack technological infrastructures such as the Internet m order to
help further their cause.The paper discusses the problems posed by
these groups and considers the nature of the responses necessary to
preserxre the future security of our society.
Keywords: Cyber Terrorism, Hackers, Information
Warfare, Internet, Security.
Introduction As we approach the new millennium, much has been
made of the so-called ‘Year 2000 Problem’ or
‘Millennium Bug’ [ 11. CZ oncern over the problem is no
doubt justified in many cases and, consequently,
demands that appropriate action be taken to avoid (at
the very least) significant disruption to everyday services. However, in a wider sense, the millennium
bug panic should also act as our ‘wake-up call’ to a more general concern, namely modern society’s over- all dependence upon information technology and communications systems. This statement is in no way
intended to promote a Luddite perspective and
suggest that IT is a negative influence, but it must be
recognized that it brings new threats to the society that it is, in other ways, benefiting.
From the perspective of someone wishing to cause
damage, there is now the capability to undermine and
disable a society without a single shot being fired or
missile being launched. To see the truth of this, it is
only necessary to consider how many essential areas of
modern society are now so significantly dependent
upon technology that its unavailability could be catas-
trophic, for example:
l healthcare;
. banking / finance;
l manufacturing;
l transportation;
l government.
Undermine the technology infrastructure and consid-
er the impact: manufacturing would cease, access to
money would be frozen and people in need of care or
support would not receive it. The new industries of
the next millennium, such as electronic commerce, could be the first victims of this new style of problem.
All of the above effects could conceivably occur as a result of an accidental incident or a lack of foresight (e.g. in the same way as the Millennium Bug issue
came about). However, this paper sets out to consider
28 0167-4048/99$20.00 0 1999 Elsevier Science Ltd. All rights reserved.
Computers & Security, Vol. 18, No. I
the potentially more alarming scenario in which
technology infrastructures or services are targeted
deliberately.The protagonists in such a scenario could
conceivably come from many backgrounds. For the
purposes of discussion, however, the paper will con-
sider them under the general categories of ‘hackers’
and ‘cyber terrorists’.
New Threats of the Information
Age The aforementioned Millennium Bug represents a
clear threat to the information society and has the
potential to cause significant damage if organizations
are not properly prepared. However, it is a problem
related to a specific point in time and it is likely that
the issue will have been safely forgotten by the major-
ity of organizations in a few months after 1 January
2000. The issues of computer hackers and cyber
terrorists can be considered to represent longer-term
threats to the Information Society.This section exam-
ines the nature of the problems and how they are
developing.
Hackers The term ‘hacker’ was originally used in computing
circles to refer to individuals who had a low-level
familiarity with the operation of technology and were
capable of devising technically elegant software solu- tions [2]. However, the usage of the term has changed
over the years and is now generally accepted as refer-
ring to persons who deliberately gain (or attempt to gain) unauthorized access to computer systems.
Hackers are by no means a new threat and have rou- tinely featured in news stories during the last two
decades. Indeed, they have become the traditional
‘target’ of the media, with the standard approach being to present the image of either a ‘teenage whizzkid’ or an insidious threat. In reality, it can be argued that there are different degrees of the problem. Some hack- ers are malicious, whilst others are merely nai’ve and, hence, do not appreciate that their activities may be doing any real harm. Furthermore, when viewed as a general population, hackers may be seen to have
numerous motivations for their actions (including
financial gain, revenge, ideology or just plain mischief
making). However, in many cases it can be argued that
this is immaterial as, no matter what the reason, the
end result is some form of adverse impact upon
another party.
Table 2 illustrates the extent of the hacking problem,
based upon figures taken from a series of surveys
conducted by the UK Audit Commission [3,4,5].
These surveys consider the general problem of com-
puter abuse, encompassing various types of incident
(including h ac mg, viruses, fraud, sabotage and theft) k’ across a number of industries/sectors (including gov-
ernment, healthcare, banking, retail and education).
The table indicates the consequences of the incidents
in terms of financial losses (which may have occurred
directly or indirectly as a result of the incidents).
However, it is likely that other, less measurable conse-
quences may also have occurred as a result (e.g.
disruption to operations, breaches df personal privacy
or commercial confidentiality etc.).
1987 1990 1994 1998
Total abuse
incidents reported 118 180 537 510
No. hacking
incidents 35 26 15 56
Hacking as %
of total 30% 14% 3% 11%
Resulting loss (f) f 100 f31,500 f 16,220 f360,860
rable 1: Reported incidents of computer hacking
As an aside, it is worth noting that the significant
increases in the ‘total incidents’ figures in the 1994 and 1998 surveys are largely accounted for by the
widespread emergence of the virus problem. It should
also be noted that these figures only refer to the report-
ed incidents - it is frequently speculated that the true figures may be much higher than this, but organiza-
tions are choosing to remain silent in order to avoid adverse publicity and the like 161.
The list below highlights a small variety of the activi- ties that hackers have been known to engage in. In
29
Computer Hacking and Cyber Terrorism/S. M. Furnell and M. J. Warren
many cases there have been reported incidents of
hackers not only gaining unauthorized access (i.e.
potentially breaching confidentiality), but also altering
data or service provision (i.e. affecting integrity and/or
availability):
l Modfication of medical records [4J.
l Breach of military systems [7].
l Monitoring and alteration of telecommunications
services IS].
As can be seen, breaches in all of the above categories
of system offer significant opportunities to inflict
damage (to both organizations and individuals) and,
therefore, illustrate the nature of the hacker threat.
Incidents such as those referenced indicate that many
of our systems are vulnerable and that if someone has
the inclination, and is willing to put in the effort, then
existing security can often be breached. Furthermore,
the evidence suggests that it is possible to breach
systems that we would instinctively expect to be more
secure (e.g. military sites).The fact that such attacks are
successful leaves systems vulnerable to more insidious
threats than straightforward hacking, in which
information systems become the target in a more
sinister way.
Cyber Terrorists
achieve their objectives and more considered selection
of suitable targets for attack. However, the difference
does not necessarily end there and other factors
should be considered. Firstly, the fact that cyber ter-
rorists are part of an organized group could mean that
they have funding available to support their activities.
This in turn would mean that individual hackers could
be hired to carry out attacks on behalf of a terrorist
organization (effectively sub-contracting the necessary
technical expertise). In this situation, the hackers
themselves may not believe in the terrorist’s ‘cause’,
but will undertake the work for financial gain.
Established terrorist groups (or related organizations)
are currently using the Internet for a number of
purposes, as described below.
Propaganda/Publicity
Terrorist/resistance groups have traditionally had dif-
ficulty in relaying their political messages to the gen-
eral public without being censored. However, they
can now use the Internet for this purpose. Examples
of where this is already the case include the Irish
Republican Information Service (http://joyce.iol.ie/
-saoirse/) and the Zapatista Movement (http://www.
ezln.org/).
Fundraisina Recent years have witnessed the widespread use of
information technology by terrorist-type organiza-
tions. This has led to the emergence of a new class of
threat, which has been termed ‘cyber terrorism’. This
can be viewed as distinct from ‘traditional’ terrorism
since physical terror does not occur and efforts are instead focused upon attacking information
systems/resources.
Some terrorist/resistance groups linked to political
parties are now using the Internet for funding raising
purposes. In the future this may mean that smaller
terrorist/resistance groups may be able to receive
the majority of their funding through credit card donations.
Information Dissemination When viewed from the perspective of skills and tech-
niques, there is little to distinguish cyber terrorists
from the general classification of hackers. Both groups
require and utilize an arsenal of techniques in order to
breach the security of target systems. From a motiva- tional perspective, however, cyber terrorists are clearly different, operating with a specific political or ideo-
logical agenda to support their actions. This in turn may result in more focused / determined efforts to
It is also possible that groups may publish sensitive
information about a particular country. For example,
Sinn Fein supporters at the University ofTexas made
details about British Army establishments within Northern Ireland publicly available on the Internet [9]. In addition, information is available about engag- ing in terrorist activities. For example, the ‘Terrorist
Handbook’ [lo] instructs beginners how to make
30
Computers & Security, Vol. 18, No. 1
explosives and weapons and is widely referenced and
available on the Internet.
Secure Communications
Terrorist use of more advanced encryption methods
[l l] and improved anonymous electronic re-mailers
will result in a command system that is difficult to
break and allows for the control of groups anywhere
in the world. This causes a problem for the security
services, as it means that they will have to spend more
time and resources on trying to decrypt electronic
messages.
Whilst all of the above might give cause for concern,
they merely illustrate how existing activities may be
simplified via new technology. The real threat in the
‘cyber’ context is when the Internet (or the more
general technology infrastructure) becomes the medi-
um in which a terrorist-type attack is conducted. In
this sense, it is somewhat ironic that the Internet
(which was originally conceived as a means of ensur-
ing continued communications in the event of a
nuclear war destroying the conventional telecommu-
nications infrastructure) should now itself represent a
medium through which widespread damage can be
caused to the new information society.
It is possible to view technology as some kind of
“great equaliser” between major countries/govern-
ments and smaller groups. This is a battlefield where
success relies upon intellectual skills and software cre-
ativity as opposed to sheer volume and physical
resources. In short, the individuals or small groups
may, in theory, have as much chance of succeeding as
a superpower.
To see the potential for damage, you only have to
look at the results of actions from individuals who
have acted without a war motive and without government/official backing. Consider the impact that computer hacking and virus incidents have had
upon businesses in recent years. In purely financial terms, the impact can be seen to be significant, as shown by the earlier figures from Table 1. A separate
survey, published by the UK National Computing Centre in 1996, revealed that the average cost of a
hacking incident was around Al4 460, whilst viruses
typically resulted in a financial cost of A41 90 [12].
Imagine what would be possible if a more deter-
mined/concentrated effort was made to coordinate
these attacks.
The most significant threats come from the integrity
and availability aspects. Security breaches in these
respects have the potential to do the most direct
damage (e.g. by making systems unavailable or having
them operate on the basis of incorrect data). Breaches
of confidentiality could, however, have an indirect
value in a terrorism or warfare context. They could,
for example, be used to provide a distraction or desta-
bilising effect to an established power (e.g. consider
the effect of the media’s preoccupation with the
Clinton/Lewinsky affair and the extent to which this
served to distract public attention from other nation-
al or world events). The potential for direct damage,
however, comes from other activities.The term ‘infor-
mation warfare’ has been used to describe the ways in
which terrorist organizations could use technology to
attack the IT infrastructure of a country or a particu-
lar company [13]. Common scenarios include denial-
of-service and direct attacks, as described below.
A denial-of-service attack results when access to a
computer or network resource is intentionally
blocked or degraded as a result of malicious action
taken by another user.These attacks do not necessar-
ily cause direct or permanent damage to data, but they
intentionally compromise the availability of the
resources [14]. This type of attack tends to affect the
availability of computer systems for legitimate usage
and the form of the activity can include methods such
as E-mail bombs - sending thousands of E-mails to
a particular computer system until that system crashes. The software required to carry out denial of
service attacks is widely available on the Internet.The
first recorded cyber terrorist denial of service attack was carried out the by Tamil Tigers against Sri Lankan embassies around the world [ 151.
A direct attack would take the form of hacking into a computer system and rewriting or stealing informa-
tion. For example, the Portuguese hacker group PHAIT (Portuguese Hackers Against Indonesian
31
Computer Hacking and Cyber Terrorism/S. M. Furnell and M. J. Warren
Tyranny), rewrote Indonesian government and conr-
mercial Web sites in order to protest about East Timor,
as illustrated in Figure 2. Since 1997 this group has
hacked and defaced (according to their sources): 20 government systems; 13 commercial systems; one aca-
demic system and another nine minor government
systems. Their campaign is still ongoing against the
government of Indonesia.
directly affected by the actions. Furthermore, acts of
violence are not necessarily the most effective ways of
making a political or ideological point - the
media/public attention is more likely to focus upon
the destruction of property and/or loss of life than
whatever ‘cause’ the activity was intended to promote.
The ability of cyber terrorism activities to affect a
wider population may give the groups involved
greater leverage in terms of achieving their objectives,
whilst at the same time ensuring that no immediate
long-term damage is caused which could cloud the
issue. For example, in a denial of service scenario, if the
threatened party was to accede to the terrorist
demands, then the situation could (ostensibly at least)
be returned to that which existed prior to the attack
(i.e. with service resumed). This is not the case in a
‘physical’ incident when death or destruction have occurred.
Figure1 : Aftermath after a Terrorist/Resistance Group
Hacker Attack
A final point to note is that cyber terrorist activity
could also be used in conjunction with or to support
more traditional attacks. For example, hacking tech-
niques could be employed to obtain intelligence
information from systems, which could then be used
as the basis for a physical attack.
An indication of the scale of the problem can be
obtained by considering particular high-profile
targets. For example, the US Department of Defense (DOD) claims that its WWW sites experience around
60 attacks each week. In 1995 alone, the DOD claimed
to have been attacked 250 000 times [ 161. The nature of these ‘attacks’ may well vary, and some will certain-
ly be less significant than others, but the overall figure
nevertheless illustrates the interest that unauthorised parties have taken in the military systems. As an aside,
the US military has now begun to rethink its attitude
towards the use of the Internet and has undertaken a
review of the material that is published on its Web sites
in order to prevent sensitive information from being
made available inadvertently [ 171.
Methods of Response Having considered the nature of the threats, it is
appropriate to consider what is needed to address
them and the extent to which appropriate action is already being taken.
The hacker problem is now widely recognized and
many countries already have some form of associated
legislation. An example of this is the Computer Misuse
Act in the United Kingdom, which specifies offences
ranging from unauthorized system access to unautho-
rized modifications to programs or data [18].
However, the mere presence of legislation is not suffi-
cient - law enforcement and the judiciary must be suitably prepared to administer it. Some previously
documented cases of hacker/computer abuse investi- gations have indicated that this may not be the case and the criminals often have a significant upper hand
in terms of their understanding of technology. A good example of this is provided by Stoll [19] in his
Another observation is that cyber attacks offer the
capability for terrorist activities with wider-reaching impacts. With traditional terrorist activities, such as
bombings, the impacts are isolated within specific physical locations and communities. In this context,
the wider populous act only as observers and are not
32
Computers & Security, Vol. 18, No. I
recounting of the experiences of law enforcement
whilst tracking the so-called ‘wily hacker’.
It is difficult to predict precisely how terrorists groups
may use the Internet in the future. However, it is
considered that cyber terrorism will become more
attractive to terrorist groups. The principal reasons for
this are as follows [20]:
The risk of capture is reduced since attacks can
occur remotely.
It is possible to inflict grave financial damage with-
out any loss of life. The expertise for these attacks can be hired.
A successful attack would result in world wide
publicity and failure would go unnoticed.
Terrorist groups can attract supporters from all over
the world.
They can use the Internet as a method of generat-
ing funds for their cause worldwide.
The Internet offers the ideal propaganda tool for a
terrorist group, one that operates on a global basis
and that individual governments cannot control or
censor.
The capability to mount an attack can be devel-
oped both quickly and cheaply
The seriousness with which the issue is taken can be
illustrated by recent activities by national govern-
ments. In the United States, for example, concern over
IT related threats has led to the establishment of the
National Infrastructure Protection Centre (NIPC).
This is a $64 million facility, employing some 500 staff
across the country, with representatives taken from
existing agencies such as the Secret Service, the CIA, NASA, the National Security Agency, the Department
of Defense and several others. The role of NIPC is to
“detect, deter, assess, warn of, respond to, and investi-
gate computer intrusions and unlawful acts” that threaten or target US critical infrastructures such as: telecommunications, energy, banking and finance, water systems, government operations and emergency
services [2 11.
Whilst the threats are undoubtedly serious, we must
be careful to ensure that our methods of response are not taken too far. Without appropriate control, it is
possible that measures could be introduced that are
harmful to society in a different way. For example, the
complete regulation or monitoring of our use of IT
systems could lead to the emergence (some would say
extension) of a ‘surveillance society’ in which technol-
ogy is used to erode individual rights and freedoms in
the name of the wider public good [22].
It can already be seen that the activities of both hack-
ers and cyber terrorists ultimately have the effect of
restricting freedoms for the rest of us. For example,
despite some concessions, the United States continues
to maintain a relatively restrictive policy on the use of
cryptographic technologies. One of the stated reasons
for control is to prevent unregulated use of strong
encryption techniques by terrorist organizations [23].
Conclusion Whether we like it or not, modern society has a sig-
nificant (and increasing) dependence upon informa-
tion technology.This paper has sought to suggest that,
as a result of this, we face a number of immediate and
long-term threats that need to be recognized in order
for protective action to be taken. This discussion has
focused upon the particular threats represented by
hackers and cyber terrorists.
In the case of hackers we can, to some extent, take
comfort from the fact that a significant proportion of
them are not engaging in their activities for a mali-
cious purposes. This is good news because, in many
ways, the hacker threat is likely to be more difficult to
police than that of cyber terrorism.The reason for this
is that the number of casual hackers far exceeds the
number of cyber terrorist organizations and their tar-
gets may be much less predictable. At the same time, however, the impact of any individual attack is likely
to be less severe.
Cyber terrorists operate with a political agenda. This motivation (which could often be more accurately
described as fanaticism) will mean these types of attacks will be more specifically targeted and aimed at
more critical systems. This collective action would do more harm than the action of a single hacker.There is also the issue of funding, since terrorist groups could
33
Computer Hacking and Cyber Terrorism/S. M. Furnell and M. J. Warren
have substantial funds available, this means that they
could easily employ hackers to act on their behalf.
In a way, the existence of hackers and cyber terrorists
lends credibility to the concept of a cyberspace infor-
mation society. Any true society will always include
elements that many of its other members would con- sider to be undesirable. However, it also indicates that
the information society is unlikely to be the Utopian
ideal that many have predicted. Technology will not
solve all of the problems from our current society -
many will simply re-emerge in different forms.
References [I] Ulrich,W.M. and Hayes. I.S. 1997. TheYear 2000 S&uare Crisis, Yourdon Press Computing Series, Prentice Hall, ISBN O-13-
655664-7.
[2]Levy, S. 1984. Ha&us : Ifcroes of the mmpufer revohction. Anchor
Press / Doubleday.
[3]Audit Commission. 1990. Survey of Compcrfer Fraud OAhuse.
[4]Audit Commission. 1994. Opportunity Makes a ThiejAn Analysis
qf Compl4terAbtrse, National Report, London, HMSO.
[S]Audit Commission. 1998. Ghost in the Machine --AM Analysis of IT Fraud and Abuse. Audit Commission Publications, UK.
February 1998. ISBN l-86240-056-3.
[h]Nycum, S.H. and Parker, D.B. 19YO. “Prosecutorial experience
with state computer crime laws in the United States”, in Security
and Profrrfion in Informafion Systems, A.Grissonnanche (Ed.),
Elsevier Science Publishers B.V., North-Holland: 307-319.
[7]Niccolai, J. 1998. “Israeli Arrested for Hacking U.S. Military
Computers”. IDG News Service, March 19, 1998. See
http://www.infowar.com/.
[8]Littman, J. lYY7. The Watchman -The Twisted I+ and Crimes cd Serial Hacker Kevin Poulserl. Little, Brown & Company Limlted.
ISBN O-316-52857-9.
[9]Tendler, S. 1996,“Ulster security details posed on the Internet”,
7%~ Times, 25 March 1996, UK.
[lO]Anonymous. 1994. 7’/1r Errorist’s Hartdbook. Available on
Internet / WWW.
[l l]Malik, I. lY96. Computer Hacking: detectioti and protection. Sigma
Press, UK, ISBN l-85058-538-5.
[ 12]NCC. I YY6. 7%~ It$mttation Security Breaches Survey 2996.
National Computing Centre, Oxford Road, Manchester, UK.
[ 131Schwartaq W. 1994. Information Warj&e: Chaos OM the Electrorric
Superh&hway.Thunder’s Mouth Press, NewYork.
[14]Howard, J. 1997. An Analysis Of Security Incidents On The
Internet. PhD thesis, Carnegie Mellon University, USA.
115IAssociated Press. 1998. “First cyber terrorist action reported”,
Mdy 6th, USA.
[ lh]McKay, N. 1998. “Cyber Terror Amend] Grows”, Wired Nrws,
I6 October 1998. http://www.wired.com/news.
[ 1 -/IBooth, N. 1998.“Pentagon gets tough in war of the Web”, The
Times, Interface Supplement, 7 October 1YY)x: 2.
[IXIHMSO. 1990. Computer Misuse Art I Y90. Her Majesty’T
Stationary Oflice, UK. ISBN O-10-541 8YO-0.
[IYjStoll. C. 1991. 7%~ Cuckoo? Egq, Pan Books Ltd, London, UK.
ISBN 0-3X-3 1742-3.
[2O]Warren, M. 1998. “Cyber Terrorism”, Proceedings of SEC-98
- IFIP World Congress, Budapest, Hungary,August 1998.
I2l]NIl-‘C. 1998. Mission Statement, National Infrastructure
Protection Centre. http://www.fbi.gov/nipc/nipc.htm
[22JDavies, S. 1996. Big Brother - Britain’s web ofsurvei/lance and the
new rechnologicaal order. Pan Book Ltd, London. ISBN O-330-
34931-7.
[23]FBI. lYY8. Encryption: Impact art law Er$vcetnenr. Information
Resources Division, Federal Bureau of Investigation,Virginia, US.
8 July 199X.
34